Luxembourg, 22 September, (Brussels Morning Newspaper) – A new European Court of Auditors report has exposed EU cybersecurity weaknesses, finding that limited information sharing between member states, overlapping responsibilities and delays to a European alert system are reducing the bloc’s ability to detect and respond to major cyberattacks.
EU auditors identify gaps in cyberattack response
The audit, published on 21 September, examined EU measures between 2022 and 2025 for detecting and responding to significant and large-scale cybersecurity incidents.
Auditors concluded that EU action was only partly effective. While cooperation mechanisms have expanded, national governments do not consistently provide other member states and EU bodies with information that could help identify and contain cross-border attacks.
The EU has allocated approximately €1.4 billion to cybersecurity under its 2021-27 budget, primarily through the Digital Europe Programme. However, auditors said greater spending and new structures have not resolved weaknesses in operational cooperation.
Information sharing remains a central problem
The auditors described poor information sharing as the “Achilles heel of the entire system”. National security legislation can restrict the information countries share, while differences in national implementation of EU cybersecurity requirements create additional difficulties.
George-Marius Hyzler, the ECA member responsible for the audit, said:
“When a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value.”
The scale of the problem is illustrated by the finding that no EU member state has reported a “large-scale” cybersecurity incident through the relevant EU framework since 2016, even though such incidents have occurred.
Airport ransomware attack highlights reporting gap
Auditors pointed to the September 2025 ransomware attack against an aviation technology provider that disrupted operations at airports including Brussels, Berlin, Dublin and London.
Despite its cross-border impact, none of the affected member states notified the EU cybersecurity agency or other member states through the relevant mechanism, according to the audit.
Hyzler said the EU’s cooperation arrangements were “not yet as effective as they should be”, despite progress in establishing a common cybersecurity framework.
European cyber alert system remains delayed
Another of the EU cybersecurity weaknesses concerns the European Cybersecurity Alert System. Auditors found that the system was still not operational, with procurement delays affecting planned capabilities and outstanding technical and cooperation arrangements.
The report also identified overlapping responsibilities among EU bodies, including between the European Commission’s cyber situation centre and threat-monitoring work performed by the EU Agency for Cybersecurity, ENISA.
Commission considers auditors’ recommendations
The findings come amid continuing cybersecurity threats against European institutions, governments and businesses. CERT-EU reported this month that Russia-linked groups had targeted EU countries with spear-phishing and social-engineering activity during August.
The European Commission said it would “carefully consider” the auditors’ recommendations to further strengthen EU detection, situational awareness and response capabilities.
The ECA is calling for better information sharing, stronger coordination, fewer duplicated functions and full implementation of the European alert system. Addressing those issues will determine how effectively the EU can turn its expanding cybersecurity framework into a coordinated response when future cross-border attacks occur.
